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Calculation method for elliptic curve cryptography 

FIELD 

The invention relates to a cryptographic method 
employed between two entities exchanging information over 
a non-secure communication channel, for example a cable 
or radio network, the method assuring the confidentiality 
5 and the integrity of information transfer between the two 
entities. The invention relates more particularly to an 
improvement to cryptosystems employing calculations on an 
elliptic curve. The improvement mainly reduces the 
calculation time. 

10 BACKGROUND 

The Dif f ie-Hellmann key exchange cryptographic 
protocol is used to exchange keys securely between two 
entities. Using it entails employing a group in the 
mathematical sense of the term. A group that can be used 

15 is constituted by an elliptic curve of the following 
type : 

y 2 + xy = x 3 + ax 2 +P 
It is known that if P = (x,y) is on the elliptic 
curve E, it is possible to define a "product" or "scalar 
20 multiplication 11 of the point P of E by an integer m. This 
operation is defined as follows: 
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[m] P = P + P + P . + P (m times) 

Doubling a chosen point P on this kind of elliptic 

curve in a Dif f ie-Hellmann key exchange algorithm is 

known in the art. This operation is known as "point 

doubling" and is part of an iterative double -and- add 

process. Any such doubling takes time. 

The slowest part of the Dif f ie-Hellman key exchange 
protocol is multiplying an unknown point on the curve by 
a random scalar. Only elliptic curves defined on a body 
of characteristic- two are considered here; this is a 
widely adopted implementation choice, because addition 
within a body of this kind corresponds to the "exclusive- 
or" operation. 

It is known in the art that multiplication by a 
scalar can be accelerated for curves defined on a body of 
low cardinality by using the Frobenius morphism. The 
curves can be chosen so that none of the known attacks 
applies to them. However, it is obviously preferable, at 
least in principle, to be able to choose the curve to be 
used from a class of curves that is as general as 
possible. The fastest version of the method in accordance 
with the invention is applied to half the elliptic 
curves. Moreover, from a cryptographic point of view, 
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that half is the best half. Before the theory of the 

method is described, the basic concepts are reviewed. 

For simplicity, consider the elliptic curve (E) 
that can be represented geometrically and is' defined for 
the set R of real numbers by the equation y 2 + y = x 3 - x 2 
shown in figure 1, in which figure a horizontal line 
represents an integer number m, a vertical line 
represents an integer number n and each intersection of 
horizontal and vertical lines represents the integer 
coordinate pair (m, n) . 

(E) passes through a finite number of points with 
integer coordinates and any secant at (E) originating 
from any such point intersects (E) at two points, which 
may be coincident (in the case of tangents to the curve) . 

The addition operation applied to any two of these 
points A and B is defined as follows: let Bi be the point 
at which the straight line segment (AB) intersects (E) ; 
the vertical through B x intersects (E) at C = A + B . 

In the special case where ( AB 1 ) is tangential to 
(E) , C 1 is the required sum. 

The "intersection of all verticals" point 0 is 
referred to as the point at infinity of (E) and is the 
neutral element of the addition defined in this way 
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since, by applying the geometrical construction which 

defines the addition: 

A+O = O+A = A 

The doubling of A, which is denoted [2] A and 
defined as : A + A, is therefore the point B', the 
straight line segment (Ax) being tangential to (E) at A. 

By applying the addition of A construction to the 
point B 1 , the point [3]A is obtained, and so on: this is 
the definition of the product [n] A of a point by an 
integer. 

The present invention in fact relates to a family 
of elliptic curves which cannot be represented 
geometrically but are defined as follows: 

Let n be a given integer, F 2 „ the body of 2 n 

elements, and F 2n its algebraic closure. Let 0 be the 
point at infinity. The non-supersingular elliptic curve E 
defined at F 2D is: 

E = { <x,y)e F 2 „ X F 2n ly 2 + xy = x 3 + ax 2 + (3} u {o} a, P e F 2 n , p * 0 

The elements of E are usually referred to as 
"points". It is well known in the art that E can be given 
an abelian group structure by taking the point at 
infinity as a neutral element. Hereinafter, the finite 
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subgroup of rational points of E is considered, and is 

defined by: 

E(F 2D ) = {(x,y)e F 2 „ X F 2D ly 2 + xy = x 3 + ox 2 + p} u {0} a, p e F 2 n , P * 0 
where N is the set of natural integers; for all m e N, 

5 the "multiplication by m" application in E is defined by: 

[m] : E -»E 

P-^P + ...... + P (m times) and VPeE:[o]P=0 

E [m] is the kernel of the application. The 
points of the group E [m] are called the m-torsion points 
10 of E. The group structure of the m-torsion points is well 
known in the art . 

In the situation in which m is a power of 2: 

Vke N:E[2 k ]=Z/2 k Z 
where Z is the set of relative integers. 

15 Because E ( F 2D ) is a finite sub-group of E, there 

exists k' > 1 such that E [2 k ] is contained in E ( F 2n ) if 

and only if k < k 1 . For the elliptic curves E for which 
k^l, the structure of E ( F 2 „ ) is: 

E(F 2 „ ) = G x {O, T 2 } 
2 0 where G is an odd order group and T 2 designates the unique 
second order point of E . A curve of this kind is said to 
have a minimal two- tors ion. 
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SUMMARY 

It is now possible to explain the object of the 
invention. Doubling is not injective when it is defined 
on E or E ( F 2 „ ) , because its kernel is: E[2] = {O, T 2 }. 

Moreover, if the domain for defining doubling is 
reduced to an odd order sub-group G <z E ( F 2 „ ) doubling 

becomes bi j ective . 

As a result doubling allows an inverse application 
to the sub-group that is referred to hereinafter as 
halving : 

[1/2] : G->G 

P^Q such that: [2] Q = P 

[1/2] P is the point of G to which the doubling 
application makes the point P correspond. 

For all k>l: 
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represents k compositions of the halving 
application with itself . 

Generally speaking, the invention therefore 
provides a cryptographic _ method employed between two 
entities exchanging information via a non-secure 
communication channel, the method including a step of 
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multiplying an odd order point of a non- supers ingular 

elliptic curve by an integer, characterized in that, for 

exchanging information via the non- secure communication 

channel, the above step includes addition and halving of 

points of said elliptic curve, the addition of points is 

an operation known in the art, the halving of a point P 

is defined as the unique odd order point D such that [2]D 



= P, 



2 



denotes the halving operation and 



2 



P denotes 



the point D. 

10 The halving application is beneficial for the 

scalar multiplication of a point on an elliptic curve for 
the following reason: if affine coordinates are used, it 
is possible to replace all doublings of a point of a 
scalar multiplication by halvings of a point. 

15 The halving of a point is much faster to calculate 

that its doubling. From a cryptographic point of view it 
is good to be able to choose from the greatest possible 
number of curves and a curve is usually used for which 
the two-torsion of E ( F 2 „ ) is minimal or isomorphic to 

20 Z/4Z. For a given curve F 2 „ the minimal two- torsion 
elliptic curves constitute exactly half of the set of 



7 



Application No. 09/786,756 
Amendment Dated November 28, 2005 
Reply to Office Action of September 28, 2005 
SECOND SUBSTITUTE SPECIFICATION 

elliptic curves defined on F 2n . This is why, although it 

is not totally general, the fastest version of the method 
described applies to a good proportion of the curves in 
interest in cryptography. It can also be applied when the 
elements of the body are represented in a normal basis. 
In the case of a polynomial basis, the memory space 
required is of the order of 0(n 2 ) bits. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Some examples are given hereinafter, with reference 
to the accompanying drawings, in which: 

[-] Figure 1 is a graph showing a very particular 
elliptic curve that can be represented geometrically and 
is used hereinafter to explain elementary operations 
employed in the context of the invention; 

[-] Figure 2 is a diagram showing exchanges of 
information in accordance with the invention between two 
entities; 

[-] Figure 3 to 6 are flowcharts explaining some 
applications conforming to the invention; and 

[-] Figure 7 is a block diagram of another system 
for exchanging information between two entities A and B 
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j 

which can employ a cryptographic method according to the 
invention. 

■i - ■ 

DETAILED DESCRIPTION 

We will show how to calculate ^ [1/2] P e G from 

P e G. We will then show how to replace the doublings of 

points by halvings to execute a multiplication by a 

scalar. 

We will use the usual affine representation of a 
point: P=(x,y) and the representation: (x, A p ) with 

X p =x+y/x. 

We derive y = x (x + \) , which uses only one 

multiplication, from the second representation. 

By proceeding in this way, to multiply a point by a 
scalar, we save on multiplications by calculating 
intermediate results using the representation (x, ^ p ) and 

the coordinate of the affine representation is determined 
only at the end of the calculation. 

A point P is halved in the following manner: 
Calculate [1/2] P from P. For this consider the two 

points of E: 

P = (x,y) = (x, x (x + \) ) , 

and Q = (u,v) = (u, u (u + X Q ) ) , 
such that: [2] Q = P. 
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The formulas for doubling known in the art yield: 

(1) A Q = u + v/u, 

(2) x = A Q 2 + A Q + a, and 

(3) y = (x+u) A Q + x + v. 

Multiplying (1) by u and inserting the value of. v 
obtained in this way in (3), the above system becomes: 

v = u (u + X Q ) , 

A Q 2 + A Q = a + x , and 

y = (x + u) A Q + x + u 2 + uA Q = u 2 + x (Aq+1) 
or, since y = x (x + X p ) : 

(i) Aq 2 +A q = (X + x / 

(ii) u 2 = (x (A Q +1) + y = (A Q + X p + x + 1) , 

and 

(iii) v = u (u + A Q ) . 

Starting from P = (x,y) = (x, x (x + A, p ) ) in affine 

coordinates or in the (x, ^ p ) representation, the above 
system of equations determines the following two types: 

[1/2] P 6G and [1 [/2] P + T 2 e E ( F 2D ) \ G 
which give P by doubling. The following property enables 

it to be distinguished. 

Let E be a minimal two- torsion elliptic curve and 
P e E(F 2 „) = G x {0, T 2 } one of its odd order elements. 

Let Q e{[l/2] P, [1/2] P+ T 2 } and let Q a be one of the two 
points of E such that [2]Qi = Q. 

We have the necessary and sufficient condition: 

10 
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Q + [1/2]P<=>Q! G E(F 2 „ ) (a) 
We deduce from this that it is possible to check if 

Q = [1/2] P by applying the formulas (i), (ii) and (iii) 

to Q and verifying if one of the points obtained belongs 

to E(F 2 J. 

We can extend this process to an elliptic curve 
E (F 2 „) = G x E [2 k ] that is arbitrary by applying the 

formulas (i), (ii) and (iii) k times: the first time to 
Q, to obtain a point Qi such that [2] Q x = Q; the ith time 
to Qi_i to obtain a point Qi such that [2] Qi = Qi-i. The 
resultant point Q k will be of the form: 

-^T7 P+T k+I if and only if Q = [1/2] P + T 2 and will be of 
2 J 

the form: 

-^-j P+T 2i with 0 < i < k if and only if Q = [1/2] P. We 

therefore have the necessary and sufficient condition: 

Q = [1/2] P <=> Q K g E(F 2D ) 

This process is evidently lengthy if k is large. 

The above equation (a) shows that we can determine 
whether Q - [1/2] P or Q = [1/2] P + T 2 by examining if the 
coordinates of Qi belong to F 2 „ or to a super-body of F 2 „ . 
As Qi is determined by the equations (i) , (ii) and (iii) , 

11 . 
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we have to study the operations used in solving these 
equations, which are not internal to the body but have 
their result on a super-body of F 2D . The only possible 

instance is that of solving the second degree equation 
(i) : we must also calculate a square root to calculate 
the first coordinate of Q lf but in characteristic- two 
finding the square root is an operation internal to the 
body . Thus : 

Q = (u, v) = [1/2] p <=> 3Xe F 2D : X 2 + X = a + u 

Because finding the square root is internal to the 
body, this necessary and sufficient condition can also be 
written : 

Q = <u, v) = [1/2] p <=> 3Ae F 2D : X 2 + X = a 2 + u 2 

The preceding relation is used to optimize the 

algorithm referred to below in instances where the square 

root calculation time is not negligible. 

For P gG, the two solutions of (i) are A[i/ 2 ]p and 

X u/ 2 ]p + 1 and we deduce from (ii) that the first 

coordinates of the associated points are u and (u + Vjc ) . 
We can therefore deduce an algorithm for calculating 
[1/2] P in the following manner: 



12 
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If F 2 „ is a finite body of 2 n elements, E ( F 2n ) is 
the sub-group of an elliptic curve E defined by: 

E(F 2n ) = {(x,y)G F 2 „ X F 2n | y 2 + xy = x 3 + ox 2 + 0"} U {o} a, 

3 e F 2n , p * O, 

and E [2 k ] is the set of points P of said elliptic curve 
such that P added 2 k times to itself gives the neutral 
element O when k is an integer greater than or equal to 1 
then a point P = (x,y) of said elliptic curve yields by 



said halving the point 



2 



P = (u C/ v 0 ) of said elliptic 



10 



curve, obtained by effecting the following operations 
illustrated by the figure 3 flowchart: 



• seek a first value X Q such that A<, 2 + Xq = a + 



x 



15 



calculate a second value u G 2 such that u D 2 = x (Xo + l) 

+ y 

if k has the value 1, check if the equation: X 2 + X = 
a 2 + u 0 2 has solutions in F 2a , 



20 



• if so, calculate said halving as follows 

= V u o 2 



and 



u 0 

v 0 = u 0 (u 0 + X 0 ) 
1 

P = (u 0/ v 0 ) 



• if not, add x to said second value u G 2 and 1 to said 
first value Xq and calculate said halving as in the 
directly preceding operation; 
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• if k is greater than 1, perform the following iterative 
calculation : 

seek a value Xi such that X ± 2 + A± = a + Ui_i 

then calculate the value u 2 i such that u 2 ± = Ui-i (A* + Ai-i 

+ Ui-i +1) 

by incrementing i from i = l until the value. u k -i 2 is 
obtained 

• check whether the equation A 2 + A = a 2 + u\-i has 
solutions in F 2 „ 

• if so, calculate said halving is as follows: 



• if not, add x to the second value u 0 2 and 1 to said 

first value Xq to calculate said halving as in the 
preceding operation. 



of the elliptic curve by (u G/ A, 0 ) with = u 0 + v o /u 0 , then 
the algorithm conforms to the figure 4 flow chart: 
• seek a first value A 0 such that A G 2 + A, Q = a + x 




and 




If we choose to represent the point — p = (u 0 ,v 0 ) 

2 
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calculate a second value u c 2 such that u Q 2 = x (X 0 + 1) + 

y / 

if k has the value 1, check if the equation: X 2 + X 0 = 
a 2 + u 2 0 has solutions in F 2 „ , 

if so, calculate said halving as follows: 
= V u o 2 



u 0 

and: I^|P = (u 0 , X 0 ) 
• if not, add x to said second value u 0 2 and 1 to said 



■ 61 



first value Xq to calculate said halving as in the 
10 preceding operation; 

• if k is greater than 1 perform the following an 
iterative calculation : 

seek a value X± such that X ± 2 + X± = a + u±-i 

then calculate the value Ui 2 such that Ui 2 = ui_i (A-i 

15 + A,±-i + Ui_i + 1) 

incrementing i from i = l until the value u 2 k _i is obtained 



check if the equation X 2 + X = a 2 + u 2 k _i has soluti 



ons 



in F 2 „ 



• if so, calculate said halving as well as follows 
2 0 u 0 = V u o 2 

if not, add x to said second value u Q 2 and 1 to said 



and 



P = (Uo, Ao) 



first value X 0 to calculate said halving as in the 
preceding operation . 
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If we choose to represent the point P = (x,y) by 

(x, A p ) setting A p = x+y/x which gives by said halving 



the point 



2 



P = (u 0 ,v 0 ) of said elliptic curve, then the 



algorithm conforms to the figure 5 flow chart: 

• seek a first value X 0 such that A<) 2 + X 0 = a + x 

• calculate a second value u Q 2 such that u G 2 = x (X 0 + + 
x + 1) 

• if k has the value 1, check if the equation: X 2 + X = 
a 2 + u 0 2 has solutions in F 2 „ , 

• if so, calculate said halving as follows: 

Uo = V U 0 2 

V 0 = U 0 (U 0 + Xq) 
1 



and : 



P = (u 0 , v 0 ) 



2^ 

• if not, add x to said second value u 0 2 and 1 to said 

first value X Q to calculate said halving as in the 
preceding operation; 

• if k is greater than 1 perform the following an 
iterative calculation : 

seek a value X± such that X 2 + X± = a + Ui_! 

then calculate the value u 2 i such that u 2 ± = Ui_! (X± 

+ Xi- ± + Ui-i + 1) 

incrementing i from i = l until the value u 2 k _i is obtained 



• check if the equation X 2 + X = a 2 + u 2 k _i has soluti 



ons 



in F 2n 
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if so, calculate said halving as well as follows: 



u 0 



v 0 = u c (u 0 + Xo) 

1 



and 



P = (u 0/ v 0 ) 



2_ 

• if not, add x to said second value u 0 2 and 1 to said 

first value Xq to calculate said halving as in the 
preceding operation. 

Finally, if we choose to represent the point P= 
(x,y) by (x, Xp) with 

Xp - x + y/x which gives by said halving the point j^- j P = 



(u 0 , v 0 ) of the elliptic curve represented by (u 0 , A^) with 

A, 0 = u 0 + v 0 /u 0 then the algorithm conforms to the figure 6 
algorithm: 



• seek a first value /L 0 such that X Q 2 + Xq = a + 



x 



calculate a second value u G 2 such that u c 2 = x {Xq + Xp + 
x + 1) , 

if k has the value 1 check if the equation X 2 +X = a 2 
+ u 0 2 has solutions in F 2D , 

if so, calculate said halving as follows: 



u 0 
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and 



P = (u 0 , A<>) 



_1 
2 

• if not, add x to said second value u G 2 and 1 to said 



first value Xo to calculate said halving as in the 
preceding operation; 

• if k is greater than 1 perform the following iterative 
calculation: 

seek a value X± such that X 2 + X± = a + u±^ 

then calculate the value u 2 ± such that \i± 2 = Ui-i {X± 

+ A,i_i + Ui_i + 1) 

incrementing i from i = l until the value u 2 k _i is obtained 

• check if the equation X 2 + X = a 2 + u 2 k _i has solutions 

in F 2 , 

• if so, calculate said halving as follows: 



U 0 

and I -HP = (u 0 , K) 



• if not, add x to said second value u 0 2 and 1 to said 

first value X 0 to calculate said halving as in the 
preceding operation . 

We next describe how to perform the check, solve 

the second degree equation and calculate the square root 
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in the algorithm for halving a point rapidly. We consider 
the normal basis and the polynomial basis. 

The normal basis results are known in the art. We 
can consider F 2D as the n-dimensional vectorial space on 

5 F 2 . In a normal basis, an element of the body is 
represented by: 

i=0 

where peF 2n is chosen such that: ^p 2 ,...^ 2 "" 1 } is a basis F 2n . 

In a normal basis, the square root is calculated by a 
10 left circular shift and squaring is effected by a right 
circular shift. The corresponding calculation times are 
therefore negligible . 

If the second degree equation: X 2 + X = x has its 

solutions in F 2n , a solution is then given by: 

n-l i 

15 ' X = X^iP 21 w ith: Ai = ^ x i 1< i < n - 1 

i=l k=l 

0 The time to calculate A is negligible compared to 

the time to calculate a multiplication of an inversion in 
the body. As the time to calculate a solution of the 
second degree equation is negligible, the check can be 
20 effected as follows: calculate a candidate X from x and 
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check if X 2 + X = x. If not, the equation has no 

solution in F 2 „ . 

In a polynomial basis, the following representation 
is used: 



n-l 

X 

i=o 



= ^ x iT J with xi e{o,l}. The square root of x can be 



calculated by storing the element Vt if we note that: 

- in a body of characteristic -two , the square root 
is a morphism of the body, 

V even 1 even ' 

10 Grouping in x the even and odd powers of T and 

taking the square root, this becomes: 



i 

V^" = 2 *i T 7 + X x i T 



i - 1 

2 



i even i odd 

so that, to calculate a square root, it is sufficient to 
"reduce" two vectors by half and therefore to execute a 

15 multiplication of a previously calculated value by an 
element of length n/2. This is why the time to calculate 
a square root in a polynomial basis is equivalent to half 
the time to calculate a multiplication in the body. 

For the check and for solving the second degree 

20 equation, we consider F 2D as a n- dimensional vectorial 

space on F 2 . The application F defined as follows: 

20 
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F : F 2 „ -» F 2D 

X -> X 2 + X 
is then a linear kernel operator {0, l} 

For a given x, the equation X 2 + X = x has its 

solutions in F 2D if and only if the vector x is in the 

image of F. Im(F) is an (n - 1) -dimensional sub- space of 
F 2 „ . For a given basis of F and the corresponding scalar 



product there exists a single non- trivial vector 
orthogonal to all the vectors of Im(F). Let w be that 
10 vector. We have: 

3X e F 2 „ : X 2 + X = x <=> x • w = 0 
Accordingly, the check can be performed by adding 

the components of x to which components of w equal to 1 
correspond. The time to perform this check is negligible. 
15 To solve the second degree equation: F (X) = X 2 + X = 

x in a polynomial basis, we propose a simple and direct 
method which imposes the storage of an n x n matrix. For 
this we look for a linear operator G such that: 

Vxelm(F) :F(G(x))=(G(x)) 2 +G(x)=x 

20 Let ye F be a vector such that y^Im(F) and define G as 



follows : 



G- F" 1 with F(r)= 



y if : i= 0 
F(r) if: l<i<n-l 
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Given that x = ^^FiT 1 ) e Im(F) then G(x) is a 

solution of the second degree equation. One 
implementation consists of precalculat ing the matrix 

representing G in the basis {l/T, , T n_1 }. In 

5 characteristic- two, the multiplication of a matrix by a 
vector is reduced to adding columns of the matrix to 
which a component of the vector equal to 1 corresponds. 
It follows that this method of solving a second degree 
equation consumes on average n/2 additions in the body 
1 0 F 2 „ . 

Application of the principles explained above to 
scalar multiplication is described below. 

Let PeE(F 2D ) be a point of odd order r, c a random 

integer and m the integer part of log 2 (r) . We calculate 
15 the product [c] P of a point by a scalar using the 
application for halving a point. 
We show that : 

For any integer c, there is a rational number of the 

form : 

/=0 ^ 

such that : 
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m c 



c ss ]T -f (mod r) 

i=0 ^ 

Let <P> be the cyclic group generated by P. Because of 
the ring isomorphism: 

P « Z/rZ 

[k]P -> k 

The scalar multiplication can be calculated as follows: 



2l 

i=0 L ^ J 

using halving and addition. We can use the double -and- add 



algorithm well known in the art for these calculations. 

10 For that it is sufficient to replace doubling by halving 
in the algorithm. It is necessary to execute log 2 (r) 
halvings and, on average, 1/2 log 2 (r) additions. There 
are improved versions of the double -and- add algorithm 
which require only 1/3 log 2 (r) additions on average. 

15 Consequently, a scalar multiplication using a 

halving as defined above is obtained by means of the 
following operations : 

- if said scalar of the multiplication is denoted S, 
choose m+1 values 

2 0 So... Sm G {0,1} to define S as follows: 



m 



i = 0 



'r + 1 ^ 



V ) 



1 
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- r being the aforementioned odd order and m being 

the single integer between log 2 (r) -1 and log 2 (r), 

calculate the. scalar multiplication [S] P of a 

point P of said elliptic curve by the scalar S by 

applying an algorithm consisting of determining the 

series of points (Q m+ i, Q m ..., ,Qi..., Q Q ) of said elliptic 

curve E such that : 



10 



Qm+i = O (neutral element) 

Qi - [Si]P + [^] Qi + 1 with ° - 1 " m 
calculate the last point Q Q of said series giving 



the result result 



2 



Qi , we use the following 



algorithm, which is a slightly modified version of the 
standard algorithm : 

Input: P = (x,y) in affine coordinates and Q = (u, 



15 



u(u + X Q ) ) represented by (u, Xq) 
Output: P + Q = (s, t) in affine coordinates 
algorithm : [S] P of said scalar multiplication 
To add the initial point P to an intermediate 
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1. Calculate: X = 



y + u(u + A, 0 ) 



x + u 



2. Calculate: s = A? + X + a + x + u 

3. Calculate: t = (s + x)^ + s + y 

4 . Result : (s, t ) 
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This algorithm uses one inversion, three 
multiplications ahd one square root. 

Much time is saved by replacing doubling by 
halving. In affine coordinates, doubling and addition 
5 both require: one inversion, two multiplications and a 
square root. If the scalar of the multiplication by a 
scalar is represented by a bit vector of length m and of 
k non-zero components, scalar multiplication requires: 



operation 


double and add 


halve and add 


inversions 


m + k 


k 


multiplications 


2m + 2k 


m + 3k 


squarings 


m + k 


k 


solutions of 
A, 2 +A,=a+x 


0 


m 


square root s 


0 


m 


checks 


0 


m 



TABLE 1 

Thus using halving saves m inversions, m-k 
multiplications and m squarings at the cost of adding m 
second degree solutions, m square roots and m checks. 

In a polynomial basis, an execution time 
improvement of around 5 0% can be obtained. 

In a normal basis, we estimate the time to 
calculate the square root, perform the check and solve 

25 
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the second degree equation negligible compared to the 

time to calculate a multiplication or an inversion. 

Assuming further that the time to calculate an inversion 

is equivalent to the time to calculate three 

multiplications, we arrive at an execution time 

improvement of 55%. 

Figure 2 is a diagram showing one possible 

application of the algorithms described above between two 

entities A and B exchanging information over a non- secure 

communication channel. Said communication channel can 

consist of simple electrical connections established 

between the two entities for the time of a transaction. 

It can also include a radio and/or optical 

telecommunication network. In this instance the entity A 

is a microcircuit card and the entity B is a server. Once 

connected to each other via said communication channel, 

the two entities apply a common key construction 

protocol . For this purpose : 

- entity A has a secret key a 

- entity B has a secret key b 

They must generate a secret key x known only to 
them from a public key consisting of a point P of odd 
order r of a chosen non- supersingular elliptic curve E. 
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The protocol employed is a Dif f ie-Hellman protocol, 

substituting for the usual "mult iplication-by- two 11 

referred to as the doubling operation in accordance with 

the invention described above and referred to as 

5 "halving". 

The algorithm for this is as follows: 

- the first entity (for example A) calculates the 
scalar multiplication [a] P and sends the result point to 
the second entity, 

10 - the second entity (B) calculates the scalar 

multiplication [b] P and sends the result point to the 
first entity, 

- the two entities respectively calculate a common 
point (C) = (x,y) of said elliptic curve (E) by 

15 respectively effecting the scalar multiplications 
[a]([b]P) and [b] ( [a] P) , both equal to [a.b]P, and 

- the two entities choose as their common key the 
coordinate x of said common point (C) obtained by said 
scalar multiplication [a.b]P, at least one of the 

20 preceding scalar multiplications, and preferably all of 
them, being effected by means of predefined halvings. 

To give a more precise example of this, figure 7 
shows a server B connected to a communication network 1 
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via a communication interface 2, for example a modem 

interface. Similarly, a calculation station 3 is 

connected to the network 1 via a communication interface 

4 . The station 3 is equipped with a microcircuit card 

5 reader 5 into which the microcircuit card A is inserted. 

The random access memory 6 of the server B contains 

a program 7 capable of executing cryptographic 

calculations on elliptic curves and in particular the 

product of a point by a scalar and the halving of a 

10 point. 

The card A contain a central processor unit 11, a 
random access memory (RAM) 8, a read-only memory (ROM) 9 
and an electrically erasable programmable read-only 
memory (EE PROM) 10. One of the memories 9 or 10 contains 
15 a program 12 capable of executing cryptographic 
calculations on elliptic curves and in particular the 
product of a point by a scalar and the halving of a 
point . 

The two programs 7 and 12 have a common reference 
2 0 consisting of the same elliptic curve (E) and the same 
point P=(x 0/ y 0 ) of (E) . 

When A wishes to construct in parallel with B a 
common secret key for securing dialog with B, it chooses 
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a scalar a and sends to B the product Q=[a]P=(x l7 y x ) . In 

response to this, B chooses a scalar b ,and sends back to 

A the product R= [b] P = (x 2/ y 2 ) . 

A then calculates the product [a] R = [ab] P 
5 (x, y) and B calculates the product [b] Q = [ab] P = 

(x, y) and A and B adopt x as a common secret key. 

These operations are represented in the table 
below. Those which are effected in the server B are 
indicated in the right-hand column and those which are 
10 effected in the card A are indicated in the left-hand 
column. The horizontal arrows symbolize transfers of 
information via the network 1. 

© © 

15 

P = (x 0/ y 0 ) P = (x 0 , y 0 ) 

choice a 

Q = [a]P = (x 1# yi ) ► 

choice b 

20 < R = [b] P = (x 2/ y 2 ) 

[a]R = (x, y) [b] Q = (x,y) 

key = x key = x 

TABLE 2 

25 Another application of the invention applies 

between the two entities A and B in figure 7. It consists 
of a protocol for signing a message M transmitted between 
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A and B via the non-secure channel, i.e. the network 1. 

The object of this protocol, the broad outlines of which 

are known in the art, is to make it certain that the 

message received by one entity was sent by the other 

entity. 

To this end, the sending entity (for example A) has 
two permanent keys, namely a secret key a and a public 
key Q = [a] P, P being a point on an elliptic curve (E) , 
and P and (E) being known to and agreed on by A and B. 
Another public key is the point P of odd order r of the 
chosen non- supersingular elliptic curve E. The operations 
effected entail halvings in the sense defined above. 

In one example: 

- the first entity (A) holding said pair of 
permanent keys constructs a single -use pair of keys, one 
key (g) chosen arbitrarily and the other r key [g] P 
resulting from scalar multiplication of said arbitrarily 
chosen key (g) by the public point P of said elliptic 
curve, the coordinates of the key ( [g] P) being denoted 
(x,y) with 2 < g < r-2, 

- the first entity (A) converts the polynomial x of 
said single-use key [g] P = (x,y) into an integer i whose 
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binary value is represented by the sequence of binary 

coefficients of said polynomial x, 

- said first entity (A) calculates a signature 
(c,d) of the message (M) as follows: 

c = i modulo r 

d = g" 1 (M + ac) modulo r, 

- said first entity sends said message (M) and said 
signature (c, d) to said second entity; on receiving it: 

- said second entity (B) checks if the elements of 
said signature (c,d) each belong to the range [1, r-1] , 

- if not, it declares the signature invalid and 

stops 

- if so, said second entity (B) calculates v three 
parameters : 

h = d" 1 modulo r 
hi = Mh modulo r 
h 2 = ch modulo r 

- said second entity calculates a point T of said 
elliptic curve by summing the scalar multiplications of 
the points P and Q by the last two parameters cited: 

T = [h x ] P + [h 2 ] Q 

if the resultant point T is the neutral element, 
said second entity declares the signature invalid and 
stops . 
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if it is not the neutral element, considering the 

point T with coordinates x 1 and y 1 : T = (x',y ! ) : 

- said second entity (B) converts the polynomial x 1 
of that point into an integer i 1 whose binary value is 

5 represented by the sequence of binary coefficients of 
said polynomial x ! , 

- said second entity (B) calculates c 1 = i ! modulo 
r , and : 

- checks that c' = c: if so it validates said 
10 signature and if not it invalidates it, at least one of 

the scalar multiplication operations and preferably all 
of them being effected by means of the predefined 
halvings . 

These operations can be represented by the table 
15 below in which the operations effected in the server B 
are indicated in the right-hand column and the operations 
effected in the card A are indicated in the left-hand 
column, the arrow between the two columns symbolizing the 
transfer of information via the network 1. 

20 
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choice g 2< g < r-2 

[g] P = x, y 

message M 

c= i mod r 

d= g" 1 (M+ac) mod r 

M, (c, d) 1 



1< c < r- 1 ? no 
yes 



error 



1< d < r-1 ? no 
yes 



error 



h = d" 1 mod r 
hi= Mh mod r 
h 2 = ch mod r 

T = [h x ] P + [ha] Q = (x 1 , y') 



yes 



T = O ? 
no 



x 



i _ 



c 1 = i 1 mod r 

c 1 =c ? no 

i 

yes 



10 



GOOD 



TABLE 3 



▼ 

BAD 
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